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Abstract. Many exponential speedups that have been achieved in quantum com- 
puting are obtained via hidden subgroup problems (HSPs). We show that the 
HSP over Weyl-Heisenberg groups can be solved efficiently on a quantum com- 
puter. These groups are well-known in physics and play an important role in 
the theory of quantum error-correcting codes. Our algorithm is based on non- 
commutative Fourier analysis of coset states which are quantum states that arise 
from a given black-box function. We use Clebsch-Gordan decompositions to 
combine and reduce tensor products of irreducible representations. Furthermore, 
we use a new technique of changing labels of irreducible representations to ob- 
tain low-dimensional irreducible representations in the decomposition process. A 
feature of the presented algorithm is that in each iteration of the algorithm the 
quantum computer operates on two coset states simultaneously. This is an im- 
provement over the previously best known quantum algorithm for these groups 
which required four coset states. 

Keywords: quantum algorithms, hidden subgroup problem, coset states 

1 Introduction 

Exponential speedups in quantum computing have hitherto been shown for only a few 
classes of problems, most notably for problems that ask to extract hidden features of cer- 
tain algebraic structures. Examples for this are hidden shift problems [DHI03], hidden 
non-linear structures [CSV07], and hidden subgroup problems (HSPs). The latter class 
of hidden subgroup problems has been studied quite extensively over the past decade. 
There are some successes such as the efficient solution of the HSP for any abelian group 
[Sho97,Kit97,BH97,ME98], including factoring and discrete log as well as Pell's equa- 
tion [Hal02], and efficient solutions for some non-abelian groups [FIM+03,BCD05]. 
Furthermore, there are some partial successes for some non-abelian groups such as the 
dihedral groups [Reg04,Kup05] and the affine groups [MRRS04]. Finally, it has been 
established that for some groups, including the symmetric group which is connected 
to the graph isomorphism problem, a straightforward approach requires a rather ex- 
pensive quantum processing in the sense that entangling operations on a large number 
of quantum systems would be required [HMR+06]. What makes matters worse, there 
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are currently no techniques, or even promising candidates for techniques, to implement 
these highly entanghng operations. 

The present paper deals with the hidden subgroup problem for a class of non-abelian 
groups that — in a precise mathematical sense that will be explained below — is not too 
far away from the abelian case, but at the same time has some distinct non-abelian 
features that make the HSP over these groups challenging and interesting. 

The hidden subgroup problem is defined as follows: we are given a function / : 
G ^ S from a group G to a set S, with the additional promise that / takes constant 
and distinct values on the left cosets gH, where g €E G, of a subgroup H < G. The task 
is to find a generating system of H. The function / is given as a black-box, i. e., it can 
only be accessed through queries and in particular whose structure cannot be further 
studied. The input size to the problem is log \ G\ and for a quantum algorithm solving 
the HSP to be efficient means to have a running time that is poly {log |G|) in the number 
of quantum operations as well as in the number of classical operations. 

We will focus on a particular approach to the HSP which proved to be successful 
in the past, namely the so-called standard method, see [GSVV04]. Here the function / 
is used in a special way, namely it is used to generate coset states which are states of 
the form 1/ \/\H\ 'J2heH 1.9^) f^'" random g G G. The task then becomes to extract a 
generating system of H from a polynomial number of coset states (for random values 
ofg).A basic question about coset states is how much information about H they indeed 
convey and how this information can be extracted from suitable measurements.^ A fixed 
POVM M operates on a fixed number k of coset states at once and if fc > 2 and Ai 
does not decompose into measurements of single copies, we say that the POVM is an 
entangled measurement. As in [HMR+06], we call the parameter k the "jointness" of 
the measurement. It is known that information-theoretically for any group G jointness 
k = 0(log |G|) is sufficient [EHK04]. While the true magnitude of the required k can 
be significantly smaller (abelian groups serve as examples for which k = 1), there are 
cases for which indeed a high order of fc = ©(log |G|) is sufficient and necessary. 
Examples for such groups are the symmetric groups [HMR"'"06]. However, on the more 
positive side, it is known that some groups require only a small, sometimes even only 
constant, amount of jointness. Examples are the Heisenberg groups of order p"* for a 
prime p for which fc = 2 is sufficient [BCD05,Bac08a]. In earlier work [ISS07], it 
has been shown that for the Weyl-Heisenberg groups order fc = 4 is sufficient 

[ISS07]. 

The goal of this paper is to show that in the latter case the jointness can be improved. 
We give a quantum algorithm which is efficient in the input size (given by logp and n) 
and which only requires a jointness of fc = 2. 

Our results and related work: The family of groups we consider in the present 
paper are well-known in quantum information processing under the name of gener- 
alized Pauli groups or Weyl-Heisenberg groups [NCOO]. Their importance in quan- 
tum computing stems from the fact that they are used to define stabilizer codes, the 
class of codes most widely used for the construction of quantum error-correcting codes 
[CRSS97,Got96,CRSS98]. 

' Recall that the most general way to extract classical information from quantum states is given 
by means of positive operator valued measures (POVMs) [NCOO]. 
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In a more group-theoretical context, the Weyl-Heisenberg groups are known as ex- 
traspecial p-groups (actually, they constitute one of the two families of extraspecial 
p-groups [Hup83]). A polynomial-time algorithm for the HSP for the extraspecial p- 
groups was already given by Ivanyos, Sanselme, and Santha, [ISS07]. Our approach 
differs to this approach in two aspects: first, our approach is based on Fourier sam- 
phng for the non-abelian group G. Second, and more importantly, we show that the 
jointness fc, i. e., the number of coset states that the algorithm has to operate jointly 
on, can be reduced from k = A Xo k — 2. Crucial for our approach is the fact that in 
the Weyl-Heisenberg group the labels of irreducible representations can be changed. 
This is turn can be used to "drive" Clebsch-Gordan decompositions in such a way that 
low-dimensional irreducible representations occur in the decomposition. 

It is perhaps interesting to note that for the Weyl-Heisenberg groups the states that 
arise after the measurement in the Fourier sampling approach (also called Fourier coef- 
ficients) are typically of a very large rank (i.e., exponential in the input size). Generally, 
large rank usually is a good indicator of the intractability of the HSP, such as in case 
of the symmetric group when iJ is a full support involution. Perhaps surprisingly, in 
the case of the Weyl-Heisenberg group it still is possible to extract H efficiently even 
though the Fourier coefficients have large rank. We achieve this at the price of operating 
on two coset states at the same time. This leaves open the question whether fc = 1 is 
possible, i. e., if the hidden subgroup H can be identified from measurements on single 
coset states. We cannot resolve this question but believe that this will be hard. Our rea- 
soning is as follows. Having Fourier coefficients of large rank implies that the random 
basis method [RRS05,Sen06] cannot be applied. The random basis method is a method 
to derive algorithms with k = I whose quantum part can be shown to be polynomial, 
provided that the rank of the Fourier coefficients is constant.^ Based on this we there- 
fore conjecture that any efficient quantum algorithm for the extraspecial groups will 
require jointness of A; > 2. 

Finally, we mention that a similar method to combine the two registers in each run 
of the algorithm has been used by Bacon [BacOSa] to solve the HSP in the Heisenberg 
groups of order p^. The method uses a Clebsch-Gordan transform which is a unitary 
transform that decomposes the tensor product of two irreducible representations [Ser77] 
into its constituents. The main difference between the Heisenberg group and the Weyl- 
Heisenberg groups is that the Fourier coefficients are no longer pure states and are of 
possibly high rank. 

Organization of the paper: In Section 2 we review the Weyl-Heisenberg group 
and its subgroup structure. The Fourier sampling approach and the so-called standard 
algorithm are reviewed in Section 3. In Section 4 we provide necessary facts about the 
representation theory that will be required in the subsequent parts. The main result of 
this paper is the quantum algorithm for the efficient solution of the HSP in the Weyl- 
Heisenberg groups presented in Section 5. Finally, we offer conclusions in Section 6. 



^ This can be obtained by combining the random basis method [Sen06] with the derandomiza- 
tion results of [AE07]. 
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2 The Weyl-Heisenberg groups 



We begin by recalling some basic group-theoretic notions. Recall that the center Z{G) 
of a group G is defined as the set of elements which commute with every element of the 
group i.e., Z{G) = {c : [c, g] = cgc~^g~^ = e for all g G G}, where e is the identity 
element of G. The derived (or commutator) subgroup G' is generated by elements of 
the type [a, b] = aba~^b~^, where a, 5 e G. The reader is invited to recall the definition 
of semidirect products G = N x H, see for instance [Hup83,Ser77]. In the following 
we give a definition of the Weyl-Heisenberg groups as a semidirect product and give 
two alternative ways of working with these groups. 



Definition 1. Let p be a prime and let n be an integer. The Weyl-Heisenberg group of 
order p^n+i defined as the semidirect product Z^^^ x:^ Z^, where the action 4> in 
the semidirect product is defined on x = (xi, . . . ,Xn) S Zp as the {n+ 1) x (n + l) 
matrix given by 

/I ... 0\ 
1 ... 
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(1) 



\Xi X2 ...XnlJ 



Any group element of Zp+ ^4>'^p can be written as a triple (.t, y, z) where x and 
y are vectors of length n whose entries are elements of Zj, and z is in Zj,. To relate this 
triple to the semidirect product, one can think of (y, z) G Zp+^ and x G Z^ . Then, the 
product of two elements in this group can be written as 



(a;, y, z) ■ {x' ,y' , z') = {x-\-x',y + y', z + z' + x' -y), (2) 

where x ■ y = J2i ^iVi ^^e dot product of two vectors (denoted as xy in the rest of 
the paper). 



Fact 1 [Hup83] For any p prime, and n > 1, the Weyl-Heisenberg group is an ex- 
traspecial p group. Recall that a group G is extraspecial if Z{G) = G', the center is 
isomorphic to Zp, and G/G' is a vector space. 

Up to isomorphism, extraspecial p-groups are of two types: groups of exponent p 

and groups of exponent p^. The Weyl-Heisenberg groups are the extraspecial p-groups 
of exponent p. It was shown in [ISS07] that an algorithm to find hidden subgroups in 
the groups of exponent p can be used to find hidden subgroups in groups of exponent 
p"^. Therefore, it is enough to solve the HSP in groups of exponent p. In this paper, we 
present an efficient algorithm for the HSP over groups of exponent p. 



Realization via matrices over Zp.- First, we recall that the Heisenberg group of order 
p^ (which is the group of 3 x 3 upper triangular matrices with ones on the main diag- 
onal and other entries in Zp) is a Weyl-Heisenberg group and can be regarded as the 
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semidirect product xi Zp. An efficient algorithm for the HSP over this group is given 
in [BCD05]. Elements of this group are of the type 




The product of two such elements is 




(3) 



1 y + y' z + z' + x'y 
1 x + x' \ (4) 
1 



Thus, such a matrix can be identified with a triple {x,y,z) in x Zp. This matrix 
representation of the Heisenberg group can be generalized for any n. We can associate 
a triple (a;, y, z) where a;, y e Z^ and z € Zj, with the (n + 2) x (n + 2) matrix 



1 ., 



. 

V . 



Vn z\ 

.. Q xi 
..01/ 



(5) 



Realization via unitary representation: Finally, there is another useful way to represent 
the Weyl-Heisenberg group. The n qupit PauU matrices form a faithful (irreducible) 
representation of the Weyl-Heisenberg p-group. For any k ^ 0, we can associate with 
any triple {x, y, z) in Zp+^ xi Z^, the following matrix: 

Pk{x,y,z)=ijl'X-Zl (6) 

where the matrix X = X^„£Z" 1^+1) (^1 the generalized X operator and the matrix 
Zk = J2uei." generaUzed Z operator, see e. g. [NCOO]. 



Subgroup structure: In the following we will write G in short for Weyl-Heisenberg 
groups. Using the notation introduced above the center Z{G) (or G') is the group 
Z{G) = {(0, 0, z)\z e Zp} and is isomorphic to Zp. As mentioned above, the quotient 
group G/G' is a vector space isomorphic to Zp". This space can be regarded as a sym- 
plectic space with the following inner product: (x, y) ■ {x' , y') = (x ■ y' — y ■ x'), where 
x, y, x',y' e Zp. The quotient map is just the restriction of the triple {x, y,z) G G 
to the pair {x, y) G Zp". From Eq. (2), it follows that two elements commute if and 
only if xy' — yx' = Q. Denote the set of (x, y) pairs occurring in H as Sh i.e., for 
each triple {x,y,z) G H, we have that {x,y) G Sh and so \Sh\ < \H\. It can be 
easily verified that Sh is a vector space and is in fact, a subspace of Zp". Indeed, for 
two elements (a;, y), {x' , y') G Sh, pick two elements (x, y, z). (x', y' , z') G H and so 
(x + x' ,y -\- y', z + z' + x'y) G H. Therefore, (x + x',y + y') G Sh- To show that if 
(x, y) G Sh, then (ax, ay) G Sh for any a G Zp, observe that if (x, y, z) G H, then 
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{x, y, z)"' = {ax, ay, az + ^^^pi^xy) € H. Therefore, {ax, ay) G Sh (in fact, it can 
be shown that Sh — HG' /G' , but we do not need this result.) Therefore, H < G is 
abeUan if and only if V(a;, y) ,{x' ,y') G Sh, we have that xy' — x'y = 0. Such a space 
where all the elements are orthogonal to each other is called isotropic. 

Now, we make a few remarks about the conjugacy class of some subgroup H. Con- 
sider conjugating H by some element of G, say g = {x',y', z'). For any h = {x, y, z) £ 
H, we obtain 

g^^hg = {-x', -y', -z' + x'y'){x, y, z){x', y' , z') 

= {-x', -y', -z' + x'y'){x + x',y + y' , z + z' + x'y) 

= {x,y,z + x'y-xy')GH3. (7) 

From this we see that Shu = Sh- We show next that Sh actually characterizes the 
conjugacy class of H. Before proving this result we need to determine the stabilizer of 
H. The stabiUzer Hs of H is defined as the set of elements of G which preserve H 
under conjugation i.e., Hs = {g G G\H^ = H}. From Eq. (7), we can see that g = 
{x', y', z') G Hs if and only if x'y — xy' — for all {x, y, z) G H. Thus, the stabilizer 
is a group such that Shs = Sjj, where Sjj is the orthogonal space under the symplectic 
inner product defined above, i.e., — {{x,y,z) G G\{x,y) G Sj^,z G Zp}. In other 
words, it is obtained by appending the pairs {x, y) G Sj^ with every possible z G Zp. 
Therefore, \Hs\ = \G'\ ■ \Sj^\. Now, we can prove the following lemma. 

Leimna 1. Two subgroups Hi and Hi are conjugate if and only if Shi = Sn^i- 

Proof. We have already seen that if Hi and H2 are conjugates, then Shi = Sh2 ■ To 
show the other direction, we use a counting argument ie., we show that the number 
of subgroups H' of G such that Sh' = Sh is equal to the number of conjugates of 
H. First, assume that the dimension of the vector space Shi is k. Now, the number 
of conjugates of Hi is the index of the stabilizer of Hi. From the above result, the 
stabilizer has a size IG'HS'^J = p • p^""*^. Therefore, the index or the number of 
conjugates of Hi are p2n+i^p2n-fc-i _ ^fc ^q^^ jjjg number of different possible 
subgroups H such that Sh = Shi is p'' since each of the k basis vectors of Shi are 
generators of the subgroup and they can have any z component independent of each 
other i.e., there are p possible choices of z for each of the k generators. 

The property G' = Z{G) will be useful in that it will allow us to consider only a 
certain class of hidden subgroups. We show next that it is enough to consider hidden 
subgroups which are abelian and do not contain G'. Recall that that H is normal in G 
(denoted H<G) if g'^hg G if for all g G G and /i G if. 

Lemma 2. IfG' < H, then H <G. 

Proof. Since G' is the commutator subgroup, for any gi, 52 G G, there exists g' G G' 
such that gig2 = g2gig'- Now, let h G H and g G G. We have g~^hg = hg' for some 
g' G G'. But since G' < H, hg' = h', for some h' G H. Therefore, g~^hg = h' and 
hence H <G. 

Lemma 3.IfH is non-abelian, then H <G. 
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Proof. Let hi,h2 & H such that hih2 ^ h2hi. Then hih2 = h2h\g' for some g' G G' 
such that g' ^ e, where e is the identity element of G. This means that g' € H. Since G' 
is cycUc of prime order, it can be generated by any g' ^ e and hence, we have G' < H. 
Now, Lemma 2 impUes that H <G. 

From these two lemmas, we have only two cases to consider for the hidden subgroup 
H: (a) H is abelian and does not contain G' and (6) H is normal in G. It is possible 
to tell the cases apart by querying the hiding function / twice and checking whether 
/(e) and f{g') are equal for some g' ^ e and g' G G'. If they are equal then G' < H 
and H < G, otherwise H is abeUan. If H is normal, then one can use the algorithm 
of [HRT03], which is efficient if one can intersect kernels of the irreducible repre- 
sentations (irreps) efficiently. For the Weyl-Heisenberg group, the higher dimensional 
irreps form a faithful representation and hence do not have a kernel. Thus, when the 
hidden subgroup is normal, only one dimensional irreps occur and their kernels can 
be intersected efficiently and the hidden subgroup can be found using the algorithm of 
[IIRT03]. Therefore, we can consider only those hidden subgroups which are abelian 
and moreover do not contain G". 

Now, we restrict our attention to the case of abehan H. Finally, we need the follow- 
ing two results. 

Lemma 4. IfH is an abelian subgroup which does not contain G', then \Sh \ = \H\. 

Proof. Suppose that for some (x, y) G Sr there exist two different elements {x, y, zi) 
and {x,y,Z2) in H, then by multiplying one with the inverse of the other we get 
(0, 0, Zi — Z2). Since zi — Z2 ^ 0, this generates G', but by our assumption on H, 
G' ^ H. Therefore, \Sh\ = \H\. 

The following theorem appUes to the case when p>2. 

Lemma 5. Let H be an abelian subgroup which does not contain G' . There exists a 
subgroup Hq conjugate to H, where Hq = {{x, y, xy/2)\{x, y) G Sh}- 

Proof We can verify that Hq is a subgroup by considering elements (a;, y, xy/2) and 
{x' , y' , x'y' /2) in H^). Their product is 

{x, y, xy/2) ■ {x', y', x'y'/2) = {x + x',y + y', xy/2 + x'y'/2 + x'y) 

= {x + x',y + y', xy/2 + x'y'/2 + {x'y + xy')/2) 
= ix + x',y + y', (x + x')iy + y')/2), (8) 

which is an element of Hq. Here, we have used the fact that H is abelian i.e., xy'—x'y = 
0, V(a;, y), {x' , y') G Sh- Now for Hq, since Shq = Sr, Hq is conjugate to H using 
Lemma 1 . 

Note that Hq can be thought of as a representative of the conjugacy class of H since 
it can be uniquely determined from Sh- The above lemma does not apply for the case 
p = 2. When = 2, we have that {x, y^z)"^ = {2x, 2y, 2z + xy) = (0, 0, xy). But since 
we assume that G' ^ H, when p = 2 we must have that xy = 0, V{x, y,z) G H. 
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3 Fourier sampling approach to HSP 

We recall some basic facts about the Fourier sampling approach to the HSP, see also 
[GSVV04,HMR+06]. First, we recall some basic notions of representation theory of 
finite groups [Ser77] that are required for this approach. Let G be a finite group, let 
C[G] to denote its group algebra, and let G be the set of irreducible representations 
(irreps) of G. We will consider two distinguished orthonormal vector space bases for 
C[G], namely, the basis given by the group elements on the one hand (denoted by l^r), 
where g E G) and the basis given by normalized matrix coefficients of the irreducible 
representations of G on the other hand (denoted by \p, where p & G, and i,j = 
1,. . . ,dp for dp, where dp denotes the dimension of p). Now, the quantum Fourier 
transform over G, QFTq is the following linear transformation [Bet87,GSVV04]: 

\9)^J2\[^\JlPi^(9)\p,i,j)- (9) 

peG * «.i=i 

An easy consequence of Schur's Lemma is that QFT^ is a unitary transformation in 
Cl*^!, mapping from the basis of \g) to the basis of \p, For a subgroup H < G and 
irrep p £ G, define p{H) := J2heH pW- Again from Schur's Lemma we obtain 
that p{H) is an orthogonal projection to the space of vectors that are point-wise fixed 
by every p{h), h £ H. 

Define rp{H) := rank(p(/f)); then rp{H) = 1/\H\ J2heH Xp{h), where Xp de- 
notes the character of p. For any subset S < G define \S) := I*) 
the uniform superposition over the elements of S. 

The standard method [GSVV04] starts from l/Vl^Z^geG 15)10)- It then queries 
/ to get the superposition X^geG l5)l/(5))- The state becomes a mixed state 

given by the density matrix cr^ = j^j 5^geG l.9^)(5-^l the second register is ig- 
nored. Applying QFT^ to a'^ gives the density matrix 

{fr00IP>O(p.»l«p*(^), 

where p* (H) operates on the space of column indices of p. The probability distribution 
induced by this base change is given by P (observe p) = '^p\^\^p^^\ it is easy to see 
that measuring the rows does not furnish any new information: indeed, the distribution 
on the row indices is a uniform distribution 1/dp. The reduced state on the space of col- 
unrn indices on the other hand can contain information about H: after having observed 
an irrep p and a row index i, the state is now collapsed to p* [H] jvp (H). From this state 
we can try to obtain further information about H via subsequent measurements. 

Finally, we mention that Fourier sampUng on fc > 2 registers can be defined in a 
similar way. Here one starts off with k independent copies of the coset state and applies 
Qprpgfe -J. jjjg jjg^j jg^fjQjj^ describe the representation theory of the Weyl- 
Heisenberg groups. An efficient implementation of QFTq is shown in Appendix A. 



HSP over Weyl-Heisenberg Groups 



9 



4 The irreducible representations 

In this section, we discuss the representation theory of G, where G = Zp+^ >^ is a 
Weyl-Heisenberg group. From the properties of being an extraspecial group, it is easy 
to see that G has p^" one dimensional irreps and p — 1 irreps of dimension p". The one 
dimensional irreps are given by 

Xa,6(^r,2/,^)=<"+''^\ (10) 

where ujp = e^'^^/P and a, 6 G Z^. Note that 

Since Sr is a linear space, this expression is non-zero if and only if a, 6 e 5^. Suppose 
we perform a QFT on a coset state and measure an irrep label. Furthermore, suppose 
that we obtain a one dimensional irrep (although the probability of this is exponentially 
small as we show in the next section). Then this would enable us to sample from Sj^. 
If this event of sampling one dimensional irreps would occur some 0{n) times, we 
would be able to compute a generating set of Sj^ with constant probability. This gives 
us information about the conjugacy class of H and from knowing this, it is easy to see 
that generators for H itself can be inferred by means of solving a suitable abelian HSP. 

Thus, obtaining one dimensional irreps would be useful. Of course we cannot as- 
sume to sample from one dimensional irreps as they have low probability of occurring. 
Our strategy will be to "manufacture" one dimensional irreps from combining higher- 
dimensional irreps. First, recall that the p" dimensional irreps are given by 

Pk{x,y,z) = E + (12) 

where k E and k ^ 0. This representation is a faithful irrep and its character is given 
by Xkig) = for g ^ e and Xk{e) = p". In particular, Xk{H) = p"/\H\. 

The probability of a high dimensional irrep occurring in Fourier sampling is very 
high (we compute this in Section 5). We consider the tensor product of two such high 
dimensional irreps. This tensor product can be decomposed into a direct sum of irreps 
of the group. A unitary base change which decomposes such a tensor product into a 
direct sum of irreps is called a Clebsch-Gordan transform, denoted by Ucg- Clebsch- 
Gordan transforms have been used impUcitly to bound higher moments of a random 
variable that describes the probability distribution of a POVM on measuring a Fourier 
coefficient. They have also been used in [BacOSa] to obtain a quantum algorithm for the 
HSP over Heisenberg groups of order p^^, and in [BacOSb] for the HSP in the groups 
-D" as well as for Simon's problem. Our use of Clebsch-Gordan transforms will be 
somewhat similar. 

For the Weyl-Heisenberg group G, the irreps that occur in the Clebsch-Gordan de- 
composition of the tensor product of high dimensional irreps Pk{g)® Pi (g) depend on 
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k and I. The Clebsch-Gordan transform for G is given by 

UcG : |«, - I ""^^^^T I" " ^' f"-- ^ + ^ = (13) 

If k + I ^ 0, then only one irrep of G occurs with multiplicity p", namely 

pk{g) ® Plig) ipr^ ® Pk+i{9)- (14) 

If A; + Z = 0, then aU the one dimensional irreps occur with multipUcity one i.e., 

Pk{9) O Pi{g) ®a,be^pXa,b{g)- (15) 

Note, however, that the state obtained after Fourier sampling is not |^ "Y^g^H Pkid) ® 
pi(g), but rather pk{H) ® Pi{H). When we apply the Clebsch-Gordan transform to 
this state, we obtain one dimensional irreps Xa,b{H) on the diagonal. Applying this to 
P-i{H) (g) pi{H) gives us 



E 

W\ ,W2 

E 



-l{yu+z)+l{y'v+z') + ^i{u+v){wi-W2)+wi{x+x'))x 



'P 



\u — V + X — x', Wl) {u — W, W2I 

5 i-(y+y')u'+2(z'-z)+wi(x+x')) x 




v' 

where u' = u — v and v' = u + v. Since v' does not occur in the quantum state, the 
sum over v' vanishes unless 1^2 = wi + y' — y. Therefore, the state is 

Ei(.-iy+y')u'+2{z'-z)+wi{x+x')), , / , , , , I 

u)p "\u +X-X ,'Wi){u ,wi+y -y\. (16) 

(ri!,H,z),(x',y',2')6H 

u',wi gZj; 

The diagonal entries are obtained by putting x = x' and y = y' and since \H\ = \Sh\, 
we get z = z'. The diagonal entry is then proportional to 

(17) 

Up to proportionality, this can be seen to be Xwi,-u' (H), a one dimensional irrep. The 
bottom line is that, although not diagonal in the Clebsch-Gordan basis, the resulting 
state's diagonal entries correspond to one dimensional irreps we are interested in. 



5 The quantum algorithm 

In this section, we present a quantum algorithm that operates on two copies of coset 
states at a time and show that it efficiently solves the HSP over G = Zp+^ x , where 
the input is n and log p. The algorithm is as follows: 
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1. Obtain two copies of coset states for G. 

2. Perform a quantum Fourier transform on each of the coset states and measure the 
irrep label and row index for each state. Assume that the measurement outcomes 
are high-dimensional irreps with labels k and I. With high probability the irreps 
are indeed both high dimensional and k + I ^ 0, when p > 2 (see the analysis 
below). When p = 2, there is only one high dimensional irrep which occurs with 
probability 1/2 and k + I = always, since k — I — 1. We deal with this case at 
the end of this section. For now assume that p> 2 and A; + ^ ^ 0. 

3. If —k/l is not a square in Zp, then we discard the pair (fc, I) and obtain a new sam- 
ple. Otherwise, perform a unitary Ua^I'- \u, v) \au, v), where a is determined 
by the two irrep labels as a = sj—kjl. This leads to a "change" in the irrep labeP 
of the first state from k to —I. We can then apply the Clebsch-Gordan transform 
and obtain one dimensional irreps. 

4. Apply a Clebsch-Gordan transform defined as 



to these states. 

5. Measure the two registers in the standard basis. With the measurement outcomes, 
we have to perform some classical post-processing which involves finding the or- 
thogonal space of a vector space. 

Now, we present the analysis of the algorithm. 

1 . In step 1 , we prepared the state |^ 1 5) 1 0) and apply the black box J7/ to obtain 
the state I.9) 1/(5))- After discarding the second register, the resulting state 
is We have two such copies. 

2. After performing a QFT over G on two such copies, we measure the irrep label 
and a row index. The probability of measuring an irrep label /x is given by pip) = 
dfiXfj.{H)\H\/\G\, where Xfi is the character of the irrep. If /i is a one-dimensional 
irrep, then the character is either or 1 and so the probability becomes or | | / 1 G | 
accordingly. The character Xfi{H) = if and only if /x = (a, b) G Sjj. Therefore, 
the total probability of obtaining a one dimensional irrep is |ff||S'^|/|G|. Now, we 
have that \H\ = \Sh\ and so |-ff||5'^| = p^" since Sj^ is the orthogonal space 
in Zp". Therefore, the total probability of obtaining a one dimensional irrep in 
the measurement is j32n^p2n+i _ ^^^^ This is exponentially small in the input 
size (logp). Therefore, the higher dimensional irreps occur with total probability of 
1 — 1/p. Since all of them have the same XtiiH) = |, each of them occurs 
with the same probability of Take two copies of coset states and perform weak 
Fourier sampling and obtain two high dimensional irreps k and I. The state is then 
-^Pk{H) (g) pi{H). In the rest, we omit the normalization ^ of each register. 




(18) 



^ We refer to Appendix B for a description of a technique that allows to change the labels of 
irreps of semidirect products that are more general than the Weyl-Heisenberg group. 
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Therefore, the state is proportional to 

Pk{H)®pi{H)= Yl uj'p^'+'^^^+'^''+y'^^\u + x,v + y){u,v\. (19) 

{x,y,z),{x',y',z')eH 

3. We can assume that k and I are such that k + I ^ since this happens with prob- 
ability {p — l)/p^. Now, choose a = ^/^- Since the equation te^ + k = has 
at most two solutions for any fc, I S Zp, for any given k, I chosen uniformly there 
exist solutions of the equation Ix"^ + k = with probabihty 1/2. Perform a unitary 
Ua ■ \u) ^ \au) on the first copy. The first register becomes proportional to 

{x,y,z)eH 

UJp \Ui + Xi){u\ 

(x,i/,z)ei?,Miez^ 
= p^{MH)), (20) 

where {xi,yi,zi) = <j)a{x,y,z) = {ax^ay^a^ z) and u\ = au. It can be seen 
easily that (ba is an isomorphism of G for a 7^ and hence (H) is subgroup of 
G. In fact, 4>a{H) is a conjugate of H since ^'^^(i/) = Sh (since if (cc, y) G 5//, 
then so is every multiple of it i.e., {ax, ay) G Sh)- Thus, we have obtained an 
irrep state with a new irrep label over a different subgroup. But this new subgroup 
is related to the old one by a known transformation. In choosing the value of a as 
above, we ensure that fc/a^ = —I and hence obtain one dimensional irreps in the 
Clebsch-Gordan decomposition. 

4. We now compute the state after performing a Clebsch-Gordan transform Ucg on 
the two copies of the coset states, i.e., perform the unitary given by the action 



Ucg : |t^,^^> E 4^"^^^''\n-v,w}. (21) 



■^(u-\-v)w I 

us 

The initial state of the two copies is 
p_i{cP„{H)) ® Pt{H) 

(J-^^^'+y'''^+^^^'+y'''^\u + xi,v + x'){u,v\. 

(«i,j/i.«i)e*a(«),(«',!/'.«')eff 
The resulting state after the transform is 

E-l(zi+yiu)+l(z' +y' v) + ^ {u+v){wi-W2) + {xi+x' )wi 
UJp X 

u,v,wuW2e'4 \U - V + XI - X ,Wl){u - V,W2\ 

E-Z(zi+2/i2i%i^)+;(2'+j/'ii-^) + ^(i)')(«'i-u)2) + (xi+x')«'i 
UJp 

(»i,yi.ii)e*a(-ff).(x'.j,',z')e-rf 



\u' + X\ — x' ,W-i){u' ,W2\, 
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where u' = u — v and v' = u + v. Notice that v' occurs only in the phase and not 
in the quantum states. Therefore, collecting the terms with v' we get 



(22) 



This term is non-zero only when y' — yi+wi—W2 = 0. Hence W2 =wi — {yi — y'). 
Substituting this back in the equation, we get 



E 



UJ.. 



^Y.xi+x')wi — (yi+y')u' — 2(zi—z')\ 



\u' + xi - x',wi){u',wi - {yi -y')\. 
Reusing the labels u and v by putting u = u' and w = wi — (yi — y'), we obtain 



E 



This can be written as 

E 



J/1, «l)e«a 



^[{xi+x')(v+(yi-y'))-(yi+y')u-2(zi-z')] 
>p 

\u + xi- x',v + yi - y'){u,v\. 

[{xi+x')v-{yi+y')u-2izi-^)+2iz'-S^)] 

\u + xi - x', V + yi- y'){u, v\. 



Since H is abelian, xiy' — x'yi = 0. Now consider the subgroup Ho defined in the 
previous section. Let g = {x, y, z) be an element such that = Hq. As discussed 
in Sec. 2, {x, y) are unique up to an element of Sj^ and z is any element in Zp. 
Now, when (x', y', z') ^ H is conjugated with g, it gives {x' , y', z' + xy' — yx') = 
[x' ,y' ,x'y' /2) G Hq. Therefore, z' — x'y' /2 = x'y — xy'. In order to obtain 
Hq from 4'a{H) we need to conjugate by 4>a{x,y,z). Therefore, zi — = 
a{yxi — xyi). Incorporating this into the above expression, we get 

\[{xi+x')v-(yi+y')u-2{a{yxi-xyi))+2(x'y-xy')\ 

\u + xi- x' , v + yi- y') (u, v\. 



E 



Now since Sh is a hnear space, we have that if {x, y), {x' , y') e Sh, then {x — 
x\ y ~ y') ^ i^H- Hence, substituting x = xi — x' ,y = yi — y', we get 



E 



j[(x+2x')v-{y+2y')u-2{a{y{x+x')-x{y+y')))+2{x'y-xy')] 



(.x,y),(x' ,y')eSH 



\u + x,v + y){u,v\. 
Separating the sums over {x, y) and {x'y') we get 



E 

{x,y)^SH,u,v&^ 



l[x' (v+(l-a)y)-y' (u+(l-a)x)] 

u + x,v + y){u,v\. 



E 

{x',y')eSH 

^[x{v—2oty)—y{u—2ax)] 
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Note that the term in the squared brackets is non-zero only when (w + (1 — a)y, u + 
(1 — q )./:) lies in Sj^. This means that if we measure the above state we obtain pairs 
(u, v) such that {u + {1 — a)x,v + {1 — a)y) G Sj^. This can be used to determine 
both Sjj (and hence Sh) and {x,y). Repeat this 0{n) times and obtain values for 
u and V by measurement. 
5 . From the above, say we obtain n + 1 values {ui,v\), . . . , (u„+i , Vn+i ) ■ Therefore, 
we have the following vectors in Sj^. 

[ui + (1 - i;i + (1 - ai)y), 

{U2 + (1 - 0L2)X, i;2 + (1 - Q!2)y), 



{Un+1 + (1 - a„+l)f , Vn+1 + (1 - Q!„+i)y). 

The affine translation can be removed by first dividing by (1 — a^) and then taking 
the differences since Sj^ is a linear space. Therefore, the following vectors he in 



(l-a„+i)'(l-ai) (l-a„+i)^' 

{U2,V2) = ijz - r, -; - -j r), 





Ui 




Un+1 


Vl 




Vn+1 


(1 


- ai) 


(1 


- an+i) ' (1 


- ai) 


(1 


- Oin+l) ' 








Un+1 






Vn+1 


(1 


- 0:2) 


(1 


- an+i) ' (1 


- CX2) 


(1 


- Oln+l) ' 




Un 




Un+1 


Vn 




Vn+1 


(1 




(1 


- CUn+l)' (1 


- Ctn) 


(1 


- an+i) 



~ \l-an) ~ {l-an+iY (1 - an) ~ {1-an+i)'' 

With high probability, these vectors form a basis for and hence we can de- 
termine Sh efficiently. This implies that the conjugacy class and hence the sub- 
group Hq is known. It remains only to determine {x,y). We can set {x,y) = 
(1 — ai)~^{ui — u[,Vi — v[) since the conjugating element can be determined 
up to addition by an element of Sj^- H can be obtained with the knowledge of Hq 
and {x,y). 

Finally, for completeness we consider the case p = 2. Assume that after Fourier sam- 
pling we have two high dimensional irreps with states given by 

pi{H) pi{H) = {-iy+''+y''+y'''\u + x,v + x'){u,v\. 

(23) 

The Clebsch-Gordan transform is given by the base change: 

E i-^r''\u + v,w}. (24) 

Applying this to the two states, we obtain (in a similar manner as above) 

E E {-ir'+'"''\\u + x,v + y){u,v\. (25) 
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The inner sum is non-zero if and only if {u, v) G Sj^. Thus, measuring this state gives 
us from which we can find Sh- We cannot determine H directly from here as in 
the case p > 2. But since we know Sh, we know the conjugacy class of H and we 
can determine the abelian group HG' which contains H. This group is obtained by 
appending the elements of Sh with every element of G' = Z2 i.e., for {x, y) € Sh we 
can say that {x, y, 0) and {x, y, 1) are in HG'. Once we know HG', we now restrict the 
hiding function / to the abelian subgroup HG' of G and run the abelian version of the 
standard algorithm to find H. In sunamary, we have shown the following result: 

Theorem 1. For n>l, and p>2 prime, the hidden subgroup problem for the Weyl- 
Heisenberg group G of order p^"^^^ can be solved on a quantum computer with 0{n) 
queries. The time complexity of the quantum algorithm can be bounded by 0{n^ logp) 
operations'^ and the algorithm uses at most k = 2 coset states at the same time. 

Sketch of proof. From the above discussion follows that 0{n) iterations of Steps 
1.-4. in the algorithm will lead to system of equations in Step 5. that with constant 
probabihty has a unique solution. The number of queries in each iteration is constant 
and the computational complexity of each of these steps can be upper bounded as fol- 
lows: 0{n logp log logp) operations for each computation of QFT over G as described 
in Appendix A. The transform Ua and the Clebsch-Gordan transform Ucg can eas- 
ily be implemented using arithmetic modulo p and QFTs over Zp, both of which can 
be done in 0{\ogp log log p) elementary quantum operations. Hence the running time 
of the quantum part of the algorithm can be upper bounded by 0{n^ ^ogp log log 
operations and the number of queries by 0{n). The overall running time is domi- 
nated by the cost for classical post-processing which consists in computing the ker- 
nel of an n X n matrix over Zp. This can be upper bounded by 0{n^) arithmetic 
operations over Zp for the Gaussian eUmination, leading to a total bit complexity of 
0{n^ \ogp log logp 2'-''^'°'5 operations when using the currently fastest known 

algorithm for integer multiplication [Fiir07]. □ 

6 Conclusions 

Using the framework of coset states and non-abelian Fourier sampling we showed that 
the hidden subgroup problem for the Weyl-Heisenberg groups can be solved efficiently. 
In each iteration of the algorithm the quantum computer operates on fc = 2 coset states 
simultaneously which is an improvement over the previously best known quantum al- 
gorithm which required /c = 4 coset states. We believe that the method of changing 
irrep labels and the technique of using Clebsch-Gordan transforms to devise multireg- 
ister experiments has some more potential for the solution of HSP over other groups. 
Finally, this group has importance in error correction. In fact, the state we obtain after 
Fourier sampling and measurement of an irrep is a projector onto the code space whose 
stabilizer generators are given by the generators of H. In view of this fact, it will be 
interesting to study the implications of the quantum algorithm derived in this paper to 
the design or decoding of quantum error-correcting codes. 



Ignoring factors growing as log logp or weaker. 
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A QFT for the Weyl-Heisenberg groups 

We briefly sketch how the quantum Fourier transform (QFT) can be computed for the 
Weyl-Heisenberg groups G„ = Zp+^ x . An implementation of the QFT for the case 
where p = 2 was given in [H0y97]. This can be extended straightforwardly to p > 2 as 
follows. Using Eq. (9), we obtain that the QFT for G„ is given by the unitary operator 



E 



2. }_,.a'x'+b'y' a„x^+b„yn 



p2n—L p P P 



a ,b ,a: ,y 

an,bn,xn,yn,zel.p \0, tt' Un, t' b„) {z , x' Xn, v' yn\ 



2,a„,b„,x„,j/„eZp \k, a'a„, b'bn){z, x'xn, y'yn\ 
= t/-QFTG„_,. (26) 
The matrix U is given by 

U= E -<''""+'''^"|0>(0|® |a„,6„)(x„,y„| 

+ E ^Wp"^''(5x„,a„-6„|fc)(fc| O |a„,6„)(a;„,y„| 

= |0) (0| ® QFT^^ ® QFTz^ + ^ y . (/^ ^ QFT^'^)), (27) 

fcez; 

where Ip is the p dimensional identity matrix, 

^= E W + v,v){u,v\, (28) 



and 



(29) 



From Eq. (27) and recursive apphcation of Eq. (26) we obtain the efficient quantum 
circuit implementing QFT,^^ shown in Figure 1 . 
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Fig. 1. QFT for the Weyl-Heisenberg group. The QFT gates shown in the circuit are QFTs for 
the cyclic groups Zp. Each of these QFTs can be implemented approximately [Kit97,HH00] 
or exactly [MZ04], in both cases with a complexity bounded by 0{logp loglogp). It should 
be noted that the wires in this circuit are actually p-dimensional systems. The meaning of the 
controlled gates where the control wire is an open circle is that the operation is applied to the 
target wire if and only if the control wire is in the state |0). The meaning of the controlled P 
gates where the control wire is a closed circle here means that the gate Pk is appUed in case 
the control wire is in state \k) with k ^ 0, and Pq = Ip- Here Pk is the permutation ma- 
trix for which QFT*^*' = P^QFT holds. The complexity of this circuit can be bounded by 
0(nlogp loglogp). 



B Changing labels of irreducible representations 



In this section, we describe the technique of changing labels of irreducible representa- 
tions (irreps) in a more abstract, representation theoretic, fashion. We consider a situ- 
ation shghtly more general than the Weyl-Heisenberg groups considered in the paper, 
namely for semidirect products of the form G = Ayi^B, where ^ is an Abelian group, 
B is an arbitrary finite group, and 4> : B ^ Aut(A). We make some further assump- 
tions regarding the irreps of G that arise during Fourier sampling. First, note that in 
general there might be some irreps of G that arise as inductions [Ser77,Hup83] of ir- 
reps of A to G. Suppose that, with high probability, we sample only such irreps, so that 
we can restrict our attention to this case. This happens for the Weyl-Heisenberg groups 
discussed in this paper. Other examples are the groups isomorphic to x: Zp studied 
in [BCD05] and the affine groups [MRRS04] which are isomorphic to Zp x Zp_i. 

After Fourier sampUng and measurement of an irrep label we have the state Pk{H), 
where pk is an irrep of G and k is its label. We want to apply an operator C/s to this 
state in order to change it to a state pk'{H') corresponding to an irrep with label k', 
possibly with respect to a different subgroup H'. In the following we show how this 
can be done if Pk{H) ~ (xk T G){H), i. e., if pk is an induction of an irrep xm of A 
to G. The possible labels k' that can be obtained depend on the automorphism group of 
B, namely on those automorphisms of B that can be extended to automorphisms of G. 
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First, recall that for Xk & ^, the image of an element (a, 6) € G under the induction 
of Xk to G is given by 

(Xfc T G){a,b) = Y,Xk{4>t-^{a))\th-^){t\, (30) 

teB 

where (pi-i = {a ^ (j)~^{t){a)) G Aut(A). Now consider an automorphism of B, 
say /? e Aut(-B). Let Ub be the unitary matrix acting on C[B] corresponding to this 
automorphism. Applying Ub to Eq. (30), we get 

J2xk{ct>t-^{a)mmb-')){m\ = j2xk{Mt)i<^))mb-')){t\- (31) 

teB teB 

In order to further simplify this expression, we now suppose that we can extend the 
automorphism P to an automorphism of the whole group in the form 7 — {a, /3) G 
Aut(G'), where a E Aut(A). We derive some conditions that a has to satisfy in order 
for this extension to be possible. First, we have that 

7((ai, 6i)(a2, 62)) = 7(01, 6i)7(a2, 62). (32) 

This condition becomes 

((a062)(ai) + a(a2),&i&2) = (((/>^(f,2)a)(ai) + a(a2),/3(6i62))- (33) 

Note that in the above equation, since a and are elements of Aut(A) for all t, we 
write their product acting on a e ^ as (at^t) (a). From Eq. (33) we obtain that 

4>(3{b) = a(j)ba~'^ (34) 

for all b G B. This means that a <E A'Aut(A) (Im(<?^)) o: lies in the normalizer of 
Im{(f)), the image of (p in Aut(A). Therefore, we need to pick the pair (a, /3) such that 
the condition in Eq. (34) holds. It is clear that given a there always exists /? such that 
Eq. (34) holds but not necessarily the other way around. 

Thus, using the assumption that the automorphism can be extended to all of G, we 
can rewrite Eq. (31) as follows: 

J2xk{<t>mia))mb-')){t\ =J2xki{a-'(Pt-^a)ia))mb-')){t\. (35) 

teB teB 

Now, the inner product Xk{{c(~^ 4't-^C(){(^)) can be written as Xa-ife((0t-iQ^)(^))- 
Therefore, the state is given by 

J2xa-^k{<Pt-^Ha))mb)-'){t\ = ixk' T G)(7(a,6)), (36) 
teB 

where k' = a^^{k). Here, a is an automorphism of the dual group A corresponding to 
a such that the character remains invariant. Overall, we have shown the following: 

Theorem 2, LetG = A>i^B and pk ^ (xk 1 G) G G, where Xk G A. LetUB G C[B] 
be the unitary matrix corresponding to an automorphism (3 G Aut(i?) that can be 
extended to 7 = (a, ,3) G Aut(G). Then by applying Ub to the hidden subgroup state 
Pk, we can change it to: 

UBPk{H)Ul=pk\l{H)), (37) 

where k' = a~^{k). 



